Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Risks and capability

Four global risk objects open the portfolio. Order carries no rank. Each is read across driver, exposure, vulnerability, capacity, cascade and consequence; loss metrics are added only where they can be modelled.

5 min read0 figures1 table19 notesNR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1Lifelines fail together
  4. 2Key findings
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
    1. 4.1 Risk objects
    2. 4.2 Capability ladder
  7. 5Power loss that overlaps a telecom or cloud failure
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

4.1Risk objects

Each risk is read across the chain from hazard to consequence, with its status and evidence-quality level.

  1. ReportedEQL 4RSK-SR02-INF-001

    Grid failure with telecom and water knock-on

    Driver
    interacting technical factors in a synchronous grid1
    Exposure
    cities, hospitals, water works, exchanges
    Vulnerability
    uneven stabilisation capability; shared dependence on power
    Capacity
    black-start plans; priority supply; operator coordination
    Cascade
    ENE → INF → WAT, HLT
    Horizon
    1 to 3 years

  2. InferredEQL 3RSK-SR02-CYB-002

    Pre-positioned access in operator networks

    Driver
    state-sponsored access reported in four sectors2
    Exposure
    communications, energy, transport and water operators
    Vulnerability
    internet-facing devices; long dwell time
    Capacity
    logging; phishing-resistant authentication; segmentation5
    Cascade
    DAT → INF → HLT
    Horizon
    1 to 5 years

  3. ReportedEQL 4RSK-SR02-DAT-003

    Common-vendor software failure

    Driver
    one faulty update on a widely deployed platform4
    Exposure
    airlines, hospitals, banks, broadcasters
    Vulnerability
    concentrated vendors; automatic update paths
    Capacity
    staged roll-out; manual fallback; recovery playbooks
    Cascade
    DAT → INF → FIN, HLT
    Horizon
    annual

  4. InferredEQL 3RSK-SR02-INF-004

    Subsea link loss with limited repair capacity

    Driver
    about 199 faults a year, mostly accidental7
    Exposure
    island states, landing-point regions, cloud routes
    Vulnerability
    few repair vessels; ageing fleet15
    Capacity
    route diversity; repair agreements; cable protection7
    Cascade
    INF → DAT → FIN
    Horizon
    1 to 5 years

4.2Capability ladder

Existence is not readiness. Each of the fifteen capability functions is placed on the ladder by the strongest public evidence at the global level, from a policy listing to performance in real events.

Table 4.1Capabilities on the ladder of evidence: listed, exists, demonstrated, tested
FunctionRungLevelStrongest public evidence at baseline
Prevention and mitigationEXISTSsecurity and continuity standards widespread; implementation uneven52022
Monitoring and observationADEQUATEthreat reporting by agencies; operator data uneven23
Early warningEXISTSadvisories from agencies; no common cross-sector warning
Preparedness and planningEXISTScritical-entity rules in force or being applied1618
Redundancy and reservesLISTEDblack-start and spare-capacity data not consolidated
ResponseDEMONSTRATEDoperators restored services after the 2024 and 2025 events14
Continuity of critical servicesEXISTSpriority supply to hospitals and water works in many systems; testing uneven
RecoveryDEMONSTRATEDIberian grid restored; causes published1
AdaptationEXISTSresilience standards and financing advice published1123
Social protectionLISTEDsupport during long outages not consolidated
Finance and insuranceEXISTSresilience financing guidance; protection gaps in sibling editions1011
Institutional coordinationEXISTSEU and national frameworks; cross-border practice uneven161718
Technical infrastructureEXISTSageing assets in places6
WorkforceLISTEDskills for operations and cable repair reported thin15
Research capacityADEQUATEinterdependency science mature282933
A capability listed in policy is not a tested one; each rung is the strongest public evidence at baseline.

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 1ENTSO-E (ed.), 28 April 2025 Iberian blackout: final report of the expert panel (publication page; report dated 20 March 2026). ENTSO-E, Brussels. Observation year 2025. Accessed 2026-11-03.back
  2. 2CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (Volt Typhoon), joint cybersecurity advisory AA24-038A, 7 February 2024. CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
  3. 5NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, 26 February 2024. National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
  4. 4Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
  5. 7TeleGeography (ed.), Is it sabotage? Unraveling the mystery of undersea cable breaks (analysis of 199 faults a year, 2010 to 2023). TeleGeography, Washington. Observation year 2024. Accessed 2026-11-03.back
  6. 15UNVERIFIED, not opened: TeleGeography (ed.), submarine cable maintenance data (June 2025; about two thirds of repair ships reach end of service life by 2040), taken from search-result summaries. TeleGeography, Washington. Observation year 2025. Accessed 2026-11-03.back
  7. 20UNVERIFIED, not opened: ISO 22301:2019, Security and resilience: business continuity management systems. International Organization for Standardization, Geneva. Observation year 2019. Accessed 2026-11-03.back
  8. 22UNVERIFIED, not opened: IEC 62443 series, Security for industrial automation and control systems. International Electrotechnical Commission, Geneva. Observation year 2018. Accessed 2026-11-03.back
  9. 3ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
  10. 16UNVERIFIED, not opened: Directive (EU) 2022/2557 on the resilience of critical entities, Official Journal of the European Union, 2022, cited from memory; the EUR-Lex request returned no text. Observation year 2022. Accessed 2026-11-03.back
  11. 18UNVERIFIED, not opened: The White House, National Security Memorandum on Critical Infrastructure Security and Resilience (NSM-22), 30 April 2024, cited from memory. Observation year 2024. Accessed 2026-11-03.back
  12. 11UNVERIFIED, not opened: Hallegatte, S., Rentschler, J. and Rozenberg, J., Lifelines: The Resilient Infrastructure Opportunity (disruptions cost at least USD 390 billion a year in low- and middle-income countries; USD 4.2 trillion net benefit; about USD 4 per USD 1), taken from search-result summaries; the repository returned an access error. World Bank and GFDRR, Washington, 2019. Observation year 2019. Accessed 2026-11-03.back
  13. 23UNVERIFIED, not opened: OECD (ed.), Good Governance for Critical Infrastructure Resilience. OECD Publishing, Paris, 2019. Observation year 2019. Accessed 2026-11-03.back
  14. 10UNVERIFIED, not opened: UNDRR (ed.), Global Assessment Report on Disaster Risk Reduction 2025: Resilience Pays (annual average loss to critical infrastructure above USD 250 billion for floods, tropical cyclones and earthquakes; about USD 2.3 trillion total annual disaster cost), taken from search-result summaries; the report page returned an access error. United Nations Office for Disaster Risk Reduction, Geneva. Observation year 2025. Accessed 2026-11-03.back
  15. 17UNVERIFIED, not opened: Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2), Official Journal of the European Union, 2022, cited from memory. Observation year 2022. Accessed 2026-11-03.back
  16. 6ASCE (ed.), 2025 Report Card for America’s Infrastructure (overall grade C; ten-year investment gap USD 3.6 trillion; sector grades). American Society of Civil Engineers, Reston. Observation year 2025. Accessed 2026-11-03.back
  17. 28UNVERIFIED, not opened: Rinaldi, S.M., Peerenboom, J.P. and Kelly, T.K., Identifying, understanding, and analysing critical infrastructure interdependencies, IEEE Control Systems Magazine 21(6), 11 to 25, 2001, cited from memory. Observation year 2001. Accessed 2026-11-03.back
  18. 29UNVERIFIED, not opened: Buldyrev, S.V. et al., Catastrophic cascade of failures in interdependent networks, Nature 464, 1025 to 1028, 2010, cited from memory. Springer Nature. Observation year 2010. Accessed 2026-11-03.back
  19. 33UNVERIFIED, not opened: Helbing, D., Globally networked risks and how to respond, Nature 497, 51 to 59, 2013, cited from memory. Springer Nature. Observation year 2013. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 4: Risks and capability. In Strategic Systems Report 2026: Critical Infrastructure and Lifeline Systems (Baseline Edition 2026, Report No. NR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Critical Infrastructure and Lifeline Systems.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskStrategic Systems

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

Sector signature

The sectors behind Critical Infrastructure and Lifeline Systems.

A reading aid: the sectors the findings run through and how strongly they depend on each other.

Select corners · hover lines6 / 15 relations

Context

Infrastructure and its partners

Infrastructure gives pipes, dams and treatment works to water (0.6), transmission and fuel logistics to energy (0.6) and access to care to health (0.5).

W · E · I · F · H · B

Sectors
4 of 6
Relations
6 of 15
Coupling
0.46 share of total

Strongest relations in play

  • Energy → Infrastructure · power for transport and telecoms0.8
  • Water → Energy · cooling water and hydropower0.6
  • Infrastructure → Water · pipes, dams and treatment works0.6
  • Water → Health · drinking water and sanitation0.7
Teaching values for a typical city-region, not measurements for any place. Coupling is the summed strength of the relations in play, as a share of all fifteen.
The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices